configuration/strings/information.fragment.strings.ts

configuration/strings/information.fragment.strings.ts is a file in Bane's Lab Site. 136 lines of code and 2 definitions.

import { INFORMATION_APPLICATION_ICON, INFORMATION_PROTECTION_ICON } from "#configuration/icons/information.icons";
import { INFORMATION_APPLICATION_SECTION_ID, INFORMATION_PROTECTION_SECTION_ID } from "#core/ids/information.ids";
import type { Section } from "#types/document.types";

export const PROTECTION_SECTION: Section = {
    icon: INFORMATION_PROTECTION_ICON,
    id: INFORMATION_PROTECTION_SECTION_ID,
    intro: "The site does not maintain accounts, login, or persistent user data storage. Your visit involves only the transport of public page content from my server to your browser, protected end-to-end by TLS.",
    subsections: [
        {
            blocks: [
                {
                    entries: [
                        { description: "No registration, login, or user accounts of any kind", term: "Accounts" },
                        { description: "No passwords, sessions, or credential storage", term: "Authentication" },
                        {
                            description: "No names, emails, payment info, or profile data stored server-side",
                            term: "Personal Data",
                        },
                        { description: "No analytics scripts, ad networks, or third-party trackers", term: "Tracking" },
                        { description: "No application cookies are set during normal browsing", term: "Cookies" },
                    ],
                    kind: "glossary",
                },
                {
                    kind: "text",
                    note: true,
                    text: "Without a user data store there is no database for an attacker to compromise. The threat model is intentionally minimal.",
                },
            ],
            title: "What I Do Not Collect",
        },
        {
            blocks: [
                {
                    entries: [
                        {
                            description: "TLS 1.2 and TLS 1.3 only (older, vulnerable protocols disabled)",
                            term: "TLS Versions",
                        },
                        {
                            description:
                                "Enabled, so recorded sessions cannot be decrypted with a long-term key exposed later",
                            term: "Perfect Forward Secrecy",
                        },
                        { description: "Enabled", term: "HTTP/2" },
                        { description: "Let's Encrypt with automatic renewal", term: "Certificate Authority" },
                        {
                            description:
                                "HTTP Strict Transport Security with 1-year duration, includeSubDomains, and preload directives",
                            term: "HSTS",
                        },
                    ],
                    kind: "glossary",
                },
                {
                    items: [
                        "ECDHE-ECDSA-AES128-GCM-SHA256",
                        "ECDHE-RSA-AES128-GCM-SHA256",
                        "ECDHE-ECDSA-AES256-GCM-SHA384",
                        "ECDHE-RSA-AES256-GCM-SHA384",
                        "ECDHE-ECDSA-CHACHA20-POLY1305",
                        "ECDHE-RSA-CHACHA20-POLY1305",
                    ],
                    kind: "list",
                    label: "Cipher Suites",
                },
            ],
            content: "All content is delivered over HTTPS with these transport settings:",
            title: "Encryption in Transit",
        },
    ],
    title: "Data Protection Overview",
};

export const APPLICATION_SECTION: Section = {
    icon: INFORMATION_APPLICATION_ICON,
    id: INFORMATION_APPLICATION_SECTION_ID,
    subsections: [
        {
            blocks: [
                {
                    headers: ["Header", "Value", "Purpose"],
                    kind: "table",
                    rows: [
                        [
                            "<code>Content-Security-Policy</code>",
                            "default-src 'none'",
                            "nothing loads unless a directive allows it; scripts and stylesheets run only with the nonce issued for that response, and 'strict-dynamic' trusts what a nonced script loads; fonts only from this origin; no framing, no plugins",
                        ],
                        ["<code>X-Content-Type-Options</code>", "nosniff", "prevents MIME type sniffing"],
                        [
                            "<code>X-Frame-Options</code>",
                            "DENY",
                            "fallback for browsers without CSP frame-ancestors, which refuses all framing",
                        ],
                        ["<code>X-XSS-Protection</code>", "0", "disabled in favor of CSP"],
                        [
                            "<code>Referrer-Policy</code>",
                            "same-origin",
                            "sends the referrer to this origin only",
                        ],
                        [
                            "<code>Permissions-Policy</code>",
                            "all denied",
                            "accelerometer, camera, geolocation, gyroscope, magnetometer, microphone, payment, USB and interest cohorts disabled",
                        ],
                        ["<code>Strict-Transport-Security</code>", "max-age=31536000", "includeSubDomains; preload"],
                        [
                            "<code>Cross-Origin-Opener-Policy</code>",
                            "same-origin",
                            "isolates the browsing context from cross-origin windows",
                        ],
                        [
                            "<code>Cross-Origin-Embedder-Policy</code>",
                            "credentialless",
                            "cross-origin resources load without credentials",
                        ],
                        [
                            "<code>Cross-Origin-Resource-Policy</code>",
                            "same-origin",
                            "pages and assets are not embeddable elsewhere; the JSON payloads and Markdown alternates are the cross-origin surfaces",
                        ],
                        [
                            "<code>tdm-reservation</code>",
                            "0",
                            "text-and-data-mining rights are not reserved; crawling, indexing and model training are consented to",
                        ],
                    ],
                },
            ],
            content:
                "Every page carries these security headers. Assets, JSON payloads and Markdown alternates carry Strict-Transport-Security, X-Content-Type-Options and Cross-Origin-Resource-Policy.",
            title: "Security Headers",
        },
    ],
    title: "Application Security",
};